« Volver al listado

CVE-2006-5729

Estado: ModificadaMedia (6.5)—

Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a message in an arbitrary forum, if authorized to create a message in any forum; and (2) perform certain unauthorized forum actions, related to an "error in how the permissions were assembled" that assigns extra permissions to users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yazd — Yazd Discussion Forum

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-5729",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-11-06T18:07:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/22690",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?group_id=39239&release_id=460547",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/20889",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29994",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29996",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/22690",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?group_id=39239&release_id=460547",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/20889",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29994",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29996",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a message in an arbitrary forum, if authorized to create a message in any forum; and (2) perform certain unauthorized forum actions, related to an \"error in how the permissions were assembled\" that assigns extra permissions to users."
    },
    {
      "lang": "es",
      "value": "Yazd Discussion Forum anterior a 3.0 beta no maneja adecuadamente los permisos del foro, lo que permite a usuarios autenticados remotamente (1) responder a un mensaje en un foro de su elección, si están autorizados a crear un mensaje en un foro cualquiera; y (2) realizar determinadas acciones no autorizadas en el foro, relacionadas con un \"error en cómo los permisos fueron ensamblados\" que asigna permisos extra a los usuarios."
    }
  ],
  "lastModified": "2026-06-16T22:31:43.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12EAF2FE-AC5C-44E7-96CF-4BC5F60A744A"
            },
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87FC657A-C2A7-4E43-B5A3-741F93795B33"
            },
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "589C134D-CCA6-4B69-B960-0FEA40CE60FD"
            },
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61596FEA-23F3-4D83-935C-6FF34E8043F2"
            },
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5072063D-04B3-4786-837C-17FC78C11023"
            },
            {
              "criteria": "cpe:2.3:a:yazd:yazd_discussion_forum:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E57FD34E-145F-498A-B2C9-2810B1EC4CE5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nYazd, Yazd Discussion Forum, 3.0 Beta"
}